Struggling to notarize DMG created with install4j v8.0.8. This is what I do:
- the install4j runs on Windows machine
- we use "MacOS folder archive" media packaged into DMG
- everything is signed as required with valid "Developer ID Application" certificate
- the DMG then taken to MacOS machine (Big Sur) where we do notarization with our own scripts
- notarization fails with an error "The signature of the binary is invalid" pointing to one specific file
When I check the signature of that binary with Mac tools it looks perfectly fine. When I check the signature of the DMG, it looks fine too:
$ codesign -vd --verbose=4 path-to-failed-binary
$ codesign -vvv --deep --display path-to.dmg
When I remove this particular binary from the package, the app gets notarized fine (there are many other binaries inside the package, like JRE). Looking around I see similar problems related to the way the package is zipped.
Which makes me wander if it even possible to create DMG on Windows machines with install4j and then doing the manual notarization on Mac? Or, there is something wrong in install4j creating the DMG package?